Regulated
Healthcare & DentalFinancial ServicesLaw FirmsAccounting & Tax FirmsGovernment & Defense ContractorsAI & Technology CompaniesArchitecture, Engineering & ConstructionEveryone else
Retail & Multi-Location StoresManufacturing & Machine ShopsReal Estate Brokerages & TitleNonprofits & AssociationsAuto Repair & Skilled TradesRestaurants, Hotels & HospitalityPrivate Schools & TutoringAgencies, Staffing & ConsultanciesSecurity · ISO / IEC
The international certification for an information security management system, issued by an accredited body and checked by a surveillance audit every year.
Rather skip the call? Get a fixed-fee ISO 27001 quote in writing.
Who it applies to
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no ISO 27001 package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the ISO 27001-specific requirements are scoped with you in a 30-minute call.
What it asks for
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
ISO 27001 opens doors outside the United States that SOC 2 does not, and the two share most of their evidence. Doing both at once is the trick.
Certification is a two-stage audit by an accredited body, then a surveillance audit each year and a recertification in year three. The standard asks for a management system, a risk assessment, a Statement of Applicability and the controls you chose from Annex A.
Most platforms give you templates for the forty-odd documents. We write the scope statement, run the risk assessment, pick the controls with you and sit with you through both stages.
Draw the boundary: tick what the certificate should cover
Draft scope statement: the ISMS covers our product and the cloud it runs on. That is the smallest certificate, and the one most buyers accept.
The steps
The whole ISO 27001 journey, short version. We handle every step with you.
What the certificate covers: which products, sites, teams and systems. Small and precise beats large and vague; the scope statement is printed on the certificate.
With AccuSights: we draft it with you from the intake form and check it against what your buyers actually asked for.
The standard wants a documented method, a register of risks, owners and a treatment plan. This is the heart of the management system and the first thing Stage 1 reads.
With AccuSights: your engineer runs it with you and writes it in the form certification bodies expect.
Ninety-three Annex A controls; you state which apply, which you have excluded and why. Auditors read this document more than any other.
With AccuSights: we map the controls you already run for SOC 2 or NIST, so the SoA starts mostly done.
Policies, access control, supplier agreements, logging, backup, incident handling and the records that prove each one ran. Most small companies underestimate the records.
With AccuSights: remediation is in-house, and the evidence collects itself in one place.
Internal audit, management review, objectives measured, corrective actions logged. Stage 2 wants to see the system running, not just written.
Does it pay for itself
An ISMS produces records all year: management review, internal audit, corrective actions. A platform files evidence; it does not chair the review. Half is a fair starting guess.
With AccuSights: we run the internal audit and chair the first management review with you.
Stage 1 is a document review: are you ready? Stage 2 is the audit proper: does the system work? Pick an accredited certification body; the accreditation mark is what buyers check.
Ten questions to ask before you sign
Years one and two after certification bring a shorter surveillance audit each; year three is recertification. Nonconformities have to be closed on time.
With AccuSights: the evidence is already filed, so surveillance is a half day, not a month.
The same control set answers SOC 2, NIST CSF and most customer questionnaires. The second framework costs a fraction of the first.
With AccuSights: we cross-map natively, so the next request is a mapping exercise, not a new project.
Why AccuSights
The platforms were built for companies with a compliance manager. We built this for the ones where the CTO is the compliance manager.
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
ISO 27001 and SOC 2 share most of their evidence. We build one control set and map it to both, so you do the work once.
What it costs
The certification body is a separate fee, paid each year. Here is what is published.
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
Questions
Also in Security: SOC 2 · NIST CSF 2.0 · CIS Controls · NIS2 · every framework by industry
Next step
Book the demo and see how one control set carries ISO 27001 and everything else you owe. Or leave your details and an engineer replies within one business day.